coimbse-extension-doc-cdn[.]pages[.]dev

Analysis of coimbse-extension-doc-cdn.pages.dev shows a newly registered domain created on 21 February 2026 that is currently listed as offline with an HTTP 403 response. The site is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 188.114.97.3, which is geolocated to the United States. Both authoritative name servers are Cloudflare‑operated (alberto.ns.cloudflare.com, stevie.ns.cloudflare.com), and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the phishing classification. The page title returned by the server reads “Suspected phishing site | Cloudflare”, and the service is identified as a credential‑phishing campaign.

Security‑vendor scans on VirusTotal recorded 2 detections out of 93 scanners, and the domain appears on a single external blocklist. It has been flagged by PhishDestroy and receives a Gridinsoft trust score of 0 / 100. Detected web technologies include HTTP/3, HSTS, and Cloudflare’s edge services. The evidence confirms that the domain is being used to host a phishing payload, but the exact target brand or credential collection page has not been disclosed in the available data.

Because the infrastructure is fully cloud‑based, the attacker can rapidly redeploy or switch to new subdomains under the same Cloudflare account. Defenders should immediately block the domain and its resolved IP at perimeter firewalls and DNS filtering layers, add the host to internal threat‑intel feeds, and monitor for any future activity from the associated Cloudflare name servers or the 188.114.97.3 address. Continuous re‑scanning with multi‑engine services is recommended to detect any changes in detection status, and security teams should watch for new registrations that reuse the same naming pattern or hosting configuration.